From 2f119401bc357bc31bc0ba2058d0077f18a900e9 Mon Sep 17 00:00:00 2001 From: Victor Lyuboslavsky Date: Tue, 17 Oct 2023 17:04:13 -0500 Subject: [PATCH] Added common code for Kolide tables. --- orbit/pkg/table/extension.go | 11 +++++++ orbit/pkg/table/extension_kolide_logger.go | 37 ++++++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 orbit/pkg/table/extension_kolide_logger.go diff --git a/orbit/pkg/table/extension.go b/orbit/pkg/table/extension.go index bb7a888dc826..b02de9c75c07 100644 --- a/orbit/pkg/table/extension.go +++ b/orbit/pkg/table/extension.go @@ -41,6 +41,12 @@ type Extension interface { // Opt allows configuring a Runner. type Opt func(*Runner) +// Global variables for osquery extension manager client and logger for Kolide tables +var ( + serverClient *osquery.ExtensionManagerClient + kolideLogger *Logger +) + // WithExtension registers the given Extension on the Runner. func WithExtension(t Extension) Opt { return func(r *Runner) { @@ -61,6 +67,8 @@ func NewRunner(socket string, opts ...Opt) *Runner { func (r *Runner) Execute() error { log.Debug().Msg("start osquery extension") + kolideLogger = NewKolideLogger() + if err := waitExtensionSocket(r.socket, 1*time.Minute); err != nil { return err } @@ -123,6 +131,9 @@ func OrbitDefaultTables() []osquery.OsqueryPlugin { // Orbit extensions. table.NewPlugin("sntp_request", sntp_request.Columns(), sntp_request.GenerateFunc), + + // Kolide extensions. + } return plugins } diff --git a/orbit/pkg/table/extension_kolide_logger.go b/orbit/pkg/table/extension_kolide_logger.go new file mode 100644 index 000000000000..f52fa9d7fdee --- /dev/null +++ b/orbit/pkg/table/extension_kolide_logger.go @@ -0,0 +1,37 @@ +package table + +import ( + "fmt" + "github.com/rs/zerolog" + "github.com/rs/zerolog/log" +) + +// Logger is a wrapper around zerolog, which we use for Kolide tables. +// Kolide uses a go-kit logger, while we are using zerolog. +type Logger struct { + zerolog.Logger +} + +// Fatal logs a fatal message, just like Kolide's logutil.Fatal. +func (l *Logger) Fatal(args ...interface{}) { + l.Logger.Fatal().Msg(fmt.Sprintln(args...)) +} + +// Log logs a message, implementing log.Logger interface +func (l *Logger) Log(keyValuePairs ...interface{}) error { + log.Logger.Info().Msg(fmt.Sprint(keyValuePairs)) + return nil +} + +// SetLevelKey sets the level key, just like Kolide's logutil.SetLevelKey. +func (l *Logger) SetLevelKey(key interface{}) *Logger { + // Note: zerolog doesn't support changing the level key dynamically like logutil, so we just log it as a warning. + l.Logger.Warn().Msgf("Attempted to set level key to: %v", key) + return l +} + +// NewKolideLogger returns the Logger struct. +func NewKolideLogger() *Logger { + // Return a Logger struct with our global logger, and use the existing global config for the log level. + return &Logger{log.Logger} +}